mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-04-08 12:02:33 +02:00
[ Upstream commit fa2408a24f ]
The logic at ghes_new() prevents allocating too large records, by
checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).
Yet, the allocation is done with the actual number of pages from the
CPER bios table location, which can be smaller.
Yet, a bad firmware could send data with a different size, which might
be bigger than the allocated memory, causing an OOPS:
Unable to handle kernel paging request at virtual address fff00000f9b40000
Mem abort info:
ESR = 0x0000000096000007
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x07: level 3 translation fault
Data abort info:
ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000
[fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000
Internal error: Oops: 0000000096000007 [#1] SMP
Modules linked in:
CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT
Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
Workqueue: kacpi_notify acpi_os_execute_deferred
pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : hex_dump_to_buffer+0x30c/0x4a0
lr : hex_dump_to_buffer+0x328/0x4a0
sp : ffff800080e13880
x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083
x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004
x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083
x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010
x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020
x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008
x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020
x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000
x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008
Call trace:
hex_dump_to_buffer+0x30c/0x4a0 (P)
print_hex_dump+0xac/0x170
cper_estatus_print_section+0x90c/0x968
cper_estatus_print+0xf0/0x158
__ghes_print_estatus+0xa0/0x148
ghes_proc+0x1bc/0x220
ghes_notify_hed+0x5c/0xb8
notifier_call_chain+0x78/0x148
blocking_notifier_call_chain+0x4c/0x80
acpi_hed_notify+0x28/0x40
acpi_ev_notify_dispatch+0x50/0x80
acpi_os_execute_deferred+0x24/0x48
process_one_work+0x15c/0x3b0
worker_thread+0x2d0/0x400
kthread+0x148/0x228
ret_from_fork+0x10/0x20
Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)
---[ end trace 0000000000000000 ]---
Prevent that by taking the actual allocated are into account when
checking for CPER length.
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
[ rjw: Subject tweaks ]
Link: https://patch.msgid.link/4e70310a816577fabf37d94ed36cde4ad62b1e0a.1767871950.git.mchehab+huawei@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
138 lines
3.6 KiB
C
138 lines
3.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef GHES_H
|
|
#define GHES_H
|
|
|
|
#include <acpi/apei.h>
|
|
#include <acpi/hed.h>
|
|
|
|
/*
|
|
* One struct ghes is created for each generic hardware error source.
|
|
* It provides the context for APEI hardware error timer/IRQ/SCI/NMI
|
|
* handler.
|
|
*
|
|
* estatus: memory buffer for error status block, allocated during
|
|
* HEST parsing.
|
|
*/
|
|
#define GHES_EXITING 0x0002
|
|
|
|
struct ghes {
|
|
union {
|
|
struct acpi_hest_generic *generic;
|
|
struct acpi_hest_generic_v2 *generic_v2;
|
|
};
|
|
struct acpi_hest_generic_status *estatus;
|
|
unsigned int estatus_length;
|
|
unsigned long flags;
|
|
union {
|
|
struct list_head list;
|
|
struct timer_list timer;
|
|
unsigned int irq;
|
|
};
|
|
struct device *dev;
|
|
struct list_head elist;
|
|
};
|
|
|
|
struct ghes_estatus_node {
|
|
struct llist_node llnode;
|
|
struct acpi_hest_generic *generic;
|
|
struct ghes *ghes;
|
|
|
|
int task_work_cpu;
|
|
struct callback_head task_work;
|
|
};
|
|
|
|
struct ghes_estatus_cache {
|
|
u32 estatus_len;
|
|
atomic_t count;
|
|
struct acpi_hest_generic *generic;
|
|
unsigned long long time_in;
|
|
struct rcu_head rcu;
|
|
};
|
|
|
|
enum {
|
|
GHES_SEV_NO = 0x0,
|
|
GHES_SEV_CORRECTED = 0x1,
|
|
GHES_SEV_RECOVERABLE = 0x2,
|
|
GHES_SEV_PANIC = 0x3,
|
|
};
|
|
|
|
#ifdef CONFIG_ACPI_APEI_GHES
|
|
/**
|
|
* ghes_register_vendor_record_notifier - register a notifier for vendor
|
|
* records that the kernel would otherwise ignore.
|
|
* @nb: pointer to the notifier_block structure of the event handler.
|
|
*
|
|
* return 0 : SUCCESS, non-zero : FAIL
|
|
*/
|
|
int ghes_register_vendor_record_notifier(struct notifier_block *nb);
|
|
|
|
/**
|
|
* ghes_unregister_vendor_record_notifier - unregister the previously
|
|
* registered vendor record notifier.
|
|
* @nb: pointer to the notifier_block structure of the vendor record handler.
|
|
*/
|
|
void ghes_unregister_vendor_record_notifier(struct notifier_block *nb);
|
|
|
|
struct list_head *ghes_get_devices(void);
|
|
|
|
void ghes_estatus_pool_region_free(unsigned long addr, u32 size);
|
|
#else
|
|
static inline struct list_head *ghes_get_devices(void) { return NULL; }
|
|
|
|
static inline void ghes_estatus_pool_region_free(unsigned long addr, u32 size) { return; }
|
|
#endif
|
|
|
|
int ghes_estatus_pool_init(unsigned int num_ghes);
|
|
|
|
static inline int acpi_hest_get_version(struct acpi_hest_generic_data *gdata)
|
|
{
|
|
return gdata->revision >> 8;
|
|
}
|
|
|
|
static inline void *acpi_hest_get_payload(struct acpi_hest_generic_data *gdata)
|
|
{
|
|
if (acpi_hest_get_version(gdata) >= 3)
|
|
return (void *)(((struct acpi_hest_generic_data_v300 *)(gdata)) + 1);
|
|
|
|
return gdata + 1;
|
|
}
|
|
|
|
static inline int acpi_hest_get_error_length(struct acpi_hest_generic_data *gdata)
|
|
{
|
|
return ((struct acpi_hest_generic_data *)(gdata))->error_data_length;
|
|
}
|
|
|
|
static inline int acpi_hest_get_size(struct acpi_hest_generic_data *gdata)
|
|
{
|
|
if (acpi_hest_get_version(gdata) >= 3)
|
|
return sizeof(struct acpi_hest_generic_data_v300);
|
|
|
|
return sizeof(struct acpi_hest_generic_data);
|
|
}
|
|
|
|
static inline int acpi_hest_get_record_size(struct acpi_hest_generic_data *gdata)
|
|
{
|
|
return (acpi_hest_get_size(gdata) + acpi_hest_get_error_length(gdata));
|
|
}
|
|
|
|
static inline void *acpi_hest_get_next(struct acpi_hest_generic_data *gdata)
|
|
{
|
|
return (void *)(gdata) + acpi_hest_get_record_size(gdata);
|
|
}
|
|
|
|
#define apei_estatus_for_each_section(estatus, section) \
|
|
for (section = (struct acpi_hest_generic_data *)(estatus + 1); \
|
|
(void *)section - (void *)(estatus + 1) < estatus->data_length; \
|
|
section = acpi_hest_get_next(section))
|
|
|
|
#ifdef CONFIG_ACPI_APEI_SEA
|
|
int ghes_notify_sea(void);
|
|
#else
|
|
static inline int ghes_notify_sea(void) { return -ENOENT; }
|
|
#endif
|
|
|
|
struct notifier_block;
|
|
extern void ghes_register_report_chain(struct notifier_block *nb);
|
|
extern void ghes_unregister_report_chain(struct notifier_block *nb);
|
|
#endif /* GHES_H */
|